B) An SPA packet must self-contain all necessary information.

A) An SPA packet must be digitally signed and authenticated.

C) An SPA header is encrypted and thus trustworthy.

D) Upon receiving an SPA, a server must respond to establish secure connectivity. Single Packet Authorization (SPA) is a method used in Zero Trust networks to securely request access to a service. A key concept of SPA is that the SPA packet must be self-contained, carrying all necessary information for the authorization decision within a single, encrypted packet. This ensures that the packet alone can provide enough context for the receiving server to authenticate the request and make an authorization decision, without needing additional information exchanges. This self-contained nature of SPA packets aligns with the principle of minimizing the movement and exposure of sensitive credentials, thus enhancing the security of the authentication process.